CVE-2021-37624
📋 TL;DR
FreeSWITCH versions before 1.10.7 do not authenticate SIP MESSAGE requests by default, allowing attackers to send spoofed chat messages to registered SIP user agents. This enables spam, social engineering, and phishing attacks by making messages appear to come from trusted sources. All FreeSWITCH deployments using default configurations are affected.
💻 Affected Systems
- FreeSWITCH
📦 What is this software?
Freeswitch by Freeswitch
⚠️ Risk & Real-World Impact
Worst Case
Attackers spoof messages from trusted entities to conduct successful phishing campaigns, credential theft, or social engineering attacks against users.
Likely Case
Spam messages sent to SIP endpoints, potentially disrupting communications and enabling basic social engineering attempts.
If Mitigated
With authentication enabled, only authenticated users can send MESSAGE requests, preventing spoofing and unauthorized messaging.
🎯 Exploit Status
Simple SIP MESSAGE requests can be sent without authentication using standard SIP tools.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.10.7
Vendor Advisory: https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjcm-q9h8-9xv3
Restart Required: Yes
Instructions:
1. Backup configuration files. 2. Upgrade to FreeSWITCH 1.10.7 or later. 3. Restart FreeSWITCH service. 4. Verify authentication is working for MESSAGE requests.
🔧 Temporary Workarounds
Enable SIP MESSAGE authentication
allSet auth-messages parameter to true in SIP profile configuration
Edit sip_profiles/internal.xml or external.xml
Add or modify: <param name="auth-messages" value="true"/>
fs_cli -x "reloadxml"
fs_cli -x "sofia profile internal restart"
🧯 If You Can't Patch
- Implement network-level controls to restrict SIP MESSAGE traffic to trusted sources only
- Deploy SIP-aware firewall or IDS/IPS to detect and block unauthenticated MESSAGE requests
🔍 How to Verify
Check if Vulnerable:
Check FreeSWITCH version and verify auth-messages parameter is not set to true in SIP profilesCheck Version:
fs_cli -x "version"Verify Fix Applied:
After upgrade, verify version is 1.10.7+ and test that unauthenticated SIP MESSAGE requests are rejected📡 Detection & Monitoring
Log Indicators:
- SIP MESSAGE requests from unauthenticated sources in FreeSWITCH logs
- Failed authentication attempts for MESSAGE requests
Network Indicators:
- SIP MESSAGE packets to port 5060/5061 without authentication headers
- Unusual spike in MESSAGE traffic
SIEM Query:
source="freeswitch.log" AND "MESSAGE" AND NOT "auth"🔗 References
- http://packetstormsecurity.com/files/164628/FreeSWITCH-1.10.6-Missing-SIP-MESSAGE-Authentication.html
- http://seclists.org/fulldisclosure/2021/Oct/44
- http://www.openwall.com/lists/oss-security/2021/10/25/6
- https://github.com/signalwire/freeswitch/releases/tag/v1.10.7
- https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjcm-q9h8-9xv3
- http://packetstormsecurity.com/files/164628/FreeSWITCH-1.10.6-Missing-SIP-MESSAGE-Authentication.html
- http://seclists.org/fulldisclosure/2021/Oct/44
- http://www.openwall.com/lists/oss-security/2021/10/25/6
- https://github.com/signalwire/freeswitch/releases/tag/v1.10.7
- https://github.com/signalwire/freeswitch/security/advisories/GHSA-mjcm-q9h8-9xv3
